Avada and Avada Builder: vulnerabilities and patches since 2020

Avada has passed a million sales on ThemeForest, and every Avada site ships with two in-house plugins, Avada Builder and Avada Core. Patchstack lists 51 distinct vulnerabilities in this set from May 2020 to October 1, 2026, 22 of them in 2026 alone, including three that allowed code execution or file deletion without any account. Here are the most severe ones, what to know about the others, and why registering your license matters as much as updating.

Avada in brief

Avada is a commercial multipurpose theme published by ThemeFusion and sold on the ThemeForest marketplace (Envato). Its product page there showed more than one million sales in fall 2026 (ThemeForest's public counter; a sale does not necessarily correspond to an active site). The product consists of three building blocks:

• the Avada theme itself;
• Avada Builder (slug fusion-builder), the page, form and element builder;
• Avada Core (slug fusion-core), which adds extra features to the theme.

As Wordfence pointed out in August 2026, Avada Builder is a plugin required by the theme, and is therefore present on every Avada site. A Builder vulnerability thus potentially affects the entire installed base.

As with any commercial theme, updates do not go through wordpress.org. According to Avada's documentation, registering the product with the ThemeForest purchase code is required to receive theme updates, and the plugins bundled with it, including Avada Builder, come through the same ThemeFusion channel. An unregistered site or a "nulled" copy therefore does not receive the fixes: that is exactly the profile of sites that remain vulnerable months after an announcement. Our article on nulled themes and plugins details the other risks of these copies.

Timeline of Avada vulnerabilities from 2020 to October 2026

The table includes the critical vulnerabilities, the high-severity ones reachable without administrator rights and those that require no account. The date is the Patchstack publication date; the CVSS score is the one from the authority that assigned the CVE (CNA), otherwise NVD's. No recognized source documents exploitation of these vulnerabilities in the wild as of this article's date.

Published	Product	Fixed in	Type	CVSS	CVE	Account required
April 19, 2022	Builder (in Avada)	3.6.2 (Avada 7.6.2) (affected: before 3.6.2, Avada up to 7.6.1)	SSRF via forms	9.8 (NVD)	CVE-2022-1386	None
October 20, 2022	Theme	7.8.2	Cross-site request forgery (CSRF)	8.8	CVE-2022-41996	None (an administrator must click)
August 10, 2023	Theme	7.11.2	File upload (options import)	8.5	CVE-2023-39307	Contributor
August 10, 2023	Theme	7.11.2	Unchecked ZIP archive extraction	9.1	CVE-2023-39312	Author
August 10, 2023	Theme	7.11.2	SSRF	7.7	CVE-2023-39313	Contributor
August 10, 2023	Builder	3.11.2	SQL injection	8.5	CVE-2023-39309	Logged-in account
August 10, 2023	Builder	3.11.2	CSRF and reflected XSS	7.1	CVE-2023-39311, CVE-2023-39306	None (the victim clicks)
February 28, 2024	Theme	7.11.5	File upload (options import)	8.8	CVE-2024-1468	Contributor
March 21, 2024	Theme	7.11.7	Directory listing of files uploaded through forms	5.3	CVE-2024-2340	None
February 12, 2025	Theme and Builder	7.11.14 and 3.11.14 (affected: up to 7.11.13 and 3.11.13)	Shortcode execution	7.3	CVE-2024-13346, CVE-2024-13345	None
May 13, 2026	Builder	3.15.2	SQL injection (if WooCommerce has been deactivated)	7.5	CVE-2026-4798	None
May 21, 2026	Builder	3.15.3	PHP code execution (render_logics)	9.8	CVE-2026-6279	None
June 15, 2026	Builder	3.15.4	PHP object injection	8.8	CVE-2026-12256	Contributor
June 15, 2026	Builder	3.15.5	PHP object injection	9.8	CVE-2026-54194	Contributor (according to the description)
June 16, 2026	Builder	3.15.5	File deletion	7.7	CVE-2026-54193	Contributor
June 18, 2026	Builder	3.15.4	File deletion via a form	9.1	CVE-2026-8713	None
June 18, 2026	Builder	3.15.5	Privilege escalation	8.8	CVE-2026-56008	Contributor
July 22, 2026	Core	5.15.7	Cross-site request forgery (CSRF)	9.6	CVE-2026-65471	None (an administrator must click)
August 26, 2026	Theme and Builder	7.16.1 and 3.16.1 (affected: up to 7.16 and 3.16)	Chain of six flaws, file write and code execution	9.8	CVE-2026-18431	None

The other 30 vulnerabilities, almost all of medium severity, can be summed up as follows:

• 2020: two vulnerabilities reported by Jérôme Bruandet (NinTechNet) and fixed in 6.2.3 on April 24, 2020: missing permission checks that let a logged-in user create, edit or delete posts, and a stored XSS (CVE-2020-36711).
• 2021: none in Patchstack; WPScan lists two XSS fixed in 7.4.2 (bbPress searches and form entries).
• 2023: two missing access controls, one in the theme, the other in the Builder, published with the August 10 batch.
• 2024: an administrator-only SQL injection (7.2), form entries readable by a contributor, one SSRF and two contributor XSS, a CSRF and the reading of password-protected posts.
• 2025: two missing access controls in the theme and four contributor XSS in the Builder.
• 2026 up to October 1: twelve medium vulnerabilities, mostly in the Builder (XSS, missing access controls, file reading by a subscriber, limited execution of WordPress actions), two in Avada Core and one CSRF in the theme, plus a reflected XSS in the Builder rated 7.1.

The notable vulnerabilities explained

2022: forms turned into relays

Calum Elrick of Rootshell Security discovered that a parameter in Avada Builder forms was not validated: an anonymous visitor could make the server send HTTP requests to any address, including the hosting provider's local network or services that only listen on the machine, and read the response (CVE-2022-1386). ThemeFusion fixed it in Avada 7.6.2, released as a security update, along with Builder 3.6.2.

August 2023: eight vulnerabilities at once

Rafie Muhammad, a Patchstack researcher, reported a series of theme and Builder vulnerabilities to the vendor on July 6, 2023. The most severe concerned file uploads: the options import function let a contributor drop a PHP file (CVE-2023-39307), and ZIP archive extraction allowed the same for an author (CVE-2023-39312). On top of these came an SSRF, an SQL injection in the Builder, a CSRF and a reflected XSS. The fixed versions, Avada 7.11.2 and Builder 3.11.2, were released on July 11, five days after the report; Patchstack published the details on August 10. Six months later, Muhammad Zeeshan still found a file upload by a contributor in the same import function (CVE-2024-1468, fixed in 7.11.5).

February 2025: shortcodes within everyone's reach

Michael Mazzolini showed that an Avada action passed a received value without any check to the do_shortcode function. Any visitor could therefore run the site's shortcodes, with an impact that depends on the shortcodes available. The same flaw existed in the theme and in the Builder, hence two CVEs (CVE-2024-13346 and CVE-2024-13345), fixed in 7.11.14 and 3.11.14. Divi had a vulnerability of the same kind in 2026, described in our timeline of Divi vulnerabilities.

May and June 2026: the Builder open without an account

Spring 2026 concentrated the Builder's most severe vulnerabilities; for the first three, the fixed version was released before publication:

• Code execution (CVE-2026-6279, 9.8): the render_logics attribute contained a JSON block one of whose values was passed directly to the PHP function call_user_func(), without an allowlist. The AJAX endpoint involved was open to logged-out visitors and protected only by a token visible in the code of public pages. Reported to ThemeFusion on April 15, 2026 by Tin Pham, Trong Pham and Hao Ngo, fixed in 3.15.3 (May 12), published on May 20.
• File deletion (CVE-2026-8713, 9.1): on a site where an Avada form stores submissions, a visitor could slip a path such as ../../../wp-config.php into a submission, then trigger the automatic cleanup of personal data, which deleted the targeted file. Without wp-config.php, WordPress goes back to the installation screen, which opens the way to a takeover. Fixed in 3.15.4.
• SQL injection (CVE-2026-4798, 7.5): exploitable without an account, but only if WooCommerce had been used and then deactivated. Reported by Rafie Muhammad through the Wordfence program, fixed in 3.15.2.
• Patchstack's June batch: the same researcher, daroo, also reported two PHP object injections, a file deletion and a privilege escalation reachable by a contributor, fixed in 3.15.4 and 3.15.5. See our article on PHP object injection.

August 2026: a chain found by an AI

CVE-2026-18431 is the most publicized vulnerability in Avada's history. On July 30, 2026, Argus, an agent-based automated analysis system developed by Wordfence, identified and reproduced a chain of six weaknesses (authorization, input validation, trust boundary, file handling) between the theme and the Builder. Put end to end, they let an anonymous visitor write a PHP file to the server and execute it, without any user action. According to BleepingComputer, Argus also wrote the proof-of-concept exploit in about two hours. Wordfence sent the details on August 5, ThemeFusion acknowledged receipt on August 10 and released Avada 7.16.1 and Builder 3.16.1 just before Wordfence's announcement on August 25. Wordfence considered that its conditions (certain content created by an administrator) hardly reduced the number of targets and did not publish the technical details. Both components must be updated together.

Critical Avada Theme RCE Alert - Update nowClicking loads the video from youtube-nocookie.com (YouTube, Google). Nothing loads until you click.

On the Avada Core side, the CSRF CVE-2026-65471 (9.6 according to Patchstack) targeted a logged-in administrator lured into opening a booby-trapped link; it is fixed in 5.15.7.

What this history shows

• The Builder concentrates the risk: of the 22 vulnerabilities in 2026, 17 concern Avada Builder, including three exploitable without an account with a score of 9 or more. It is the component to monitor first, like Elementor among free builders.
• An acceleration in 2026: the Wordfence and Patchstack bug bounty programs, and now automated analysis, are finding more vulnerabilities, faster. The yearly count went from 8 or 9 to 22.
• Fixes before the announcement: for the critical vulnerabilities of 2026, the fixed version came out before publication, sometimes several weeks before. An up-to-date site was protected; an unregistered site was not.
• The same features keep coming back: options import (2023 then 2024), forms (2022, 2024, 2026) and shortcode execution.

WordPress core also releases regular fixes, as shown in our timeline of WordPress security releases.

How to protect your site

• Update all three components: at least Avada 7.16.1 and Avada Builder 3.16.1, as well as Avada Core 5.15.7. Updating the theme without the Builder leaves the August 2026 chain open.
• Register every site with a valid purchase code in the Avada dashboard, otherwise no update arrives. Ban nulled copies (see our explanation).
• Automate what you can: our guide to automatic updates explains how to keep them under control, including for components that do not come from wordpress.org.
• Clean up: delete unused Avada forms, turn off submission storage when you do not need it, and remove abandoned plugins and themes (see our article). Limit contributor and author accounts (see roles and least privilege).
• Add a web application firewall to cover the gap between an announcement and your update (our WordPress firewall comparison), and watch the advisories that concern your themes (our method).

WP Masquerade Pro helps you not miss an advisory, including for a theme and plugins that wordpress.org does not track. Every day, it compares the installed versions with the public WPVulnerability.net database and sends a vulnerability alert by email with the severity and the fixed version; the member area shows pending updates and vulnerable sites, and the integrity check spots modified core files, which is useful after a file-write vulnerability. WP Masquerade alerts: it does not update Avada, does not register your license and is not a firewall. For a firewall, see our comparison of the best WordPress security plugins.

Sources

• ThemeForest: Avada, product page and sales counter (external link, opens in a new tab)
• Avada: How To Register Avada (documentation) (external link, opens in a new tab)
• CVE: CVE-2022-1386, Fusion Builder before 3.6.2 (May 16, 2022) (external link, opens in a new tab)
• CVE: CVE-2026-18431, Avada 7.16 and Fusion Builder 3.16 (August 26, 2026) (external link, opens in a new tab)

Other sources consulted: further CVE records, security research publications, trade press articles, WPScan and Patchstack databases.